Getting Data In

Windows Event collection - A really basic question, Doh

New Member

Guys, I want to use Splunk for some eval work on Windows 7 prof and server 2008 and 2012. I want to stick strictly to Universal Forwarders and not WMI. Am i reading this document link correctly below?

The words "Splunk Enterprise must run on Windows" says to me I have no option other than a Windows install of Splunk Enterprise and therefore my currently built Splunk Enterprise Red Hat server install is not fit for this purpose?

The documentation is good but pulling these simple strings together is not easy. Can anyone point me to a document that will answer these questions please?

0 Karma


Nah - you are fine. Put the appropriate UFs on your Windows devices and have the data sent back to your Red Hat indexer(s). I get why the document looks confusing but haven't had any caffeine yet so can't concisely reword it.

0 Karma
Get Updates on the Splunk Community!

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...